Philip Withnall f9d165add1 guri: Fix buffer overrun when decoding %-encoded URI components
There is a limited (1 or 2 byte) read off the end of the buffer if its
final or penultimate byte is `%` and it’s not nul-terminated after that.
If the buffer *is* nul-terminated then the first `g_ascii_isxdigit()`
call safely returns `FALSE` and the code moves on.

Fix it by adding an additional check, and some unit tests to catch the
behaviour.

This bug is present in libsoup, which `GUri` is based on, but not
exploitable due to how the external API only exposes nul-terminated
strings. See https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/126
for the fix there.

oss-fuzz#23815
oss-fuzz#23818

Signed-off-by: Philip Withnall <withnall@endlessm.com>
2020-07-01 13:28:09 +01:00
..
2019-01-15 15:11:43 +00:00
2019-08-24 19:14:05 +00:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2020-06-23 10:49:44 +01:00
2019-05-27 17:51:40 +00:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2019-01-28 15:24:06 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2020-06-23 10:49:44 +01:00
2020-06-23 10:49:44 +01:00
2020-06-23 10:49:44 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2018-01-04 22:19:30 +01:00
2019-11-25 13:09:25 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2019-10-09 16:39:31 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2019-03-15 21:30:22 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2019-05-02 13:53:09 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2019-11-25 13:09:25 +01:00
2019-09-18 10:47:23 +02:00
2018-12-17 17:16:03 +00:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2020-05-12 12:41:22 +01:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2020-06-23 10:49:44 +01:00
2019-09-27 15:47:03 +12:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2017-05-24 11:58:19 +02:00
2020-06-15 20:33:16 +04:00